QT/InvoiceShelf
1
0
Fork 0
mirror of https://github.com/InvoiceShelf/InvoiceShelf.git synced 2026-04-19 03:04:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Scope bulk delete to current company to prevent cross-company deletion

Browse Source 
Filter customer IDs through whereCompany() before passing to
deleteCustomers(), ensuring users cannot delete customers belonging
to other companies via the bulk delete endpoint.
This commit is contained in:
Darko Gjorgjijoski
2026-04-03 13:49:57 +02:00
parent 1ab5228347
commit 6092e48cf6
2 changed files with 19 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
tests/Feature/Admin/CustomerTest.php
View File

@@ -181,3 +181,17 @@ test('cannot update customer from another company', function () {
])->assertForbidden();
});
test('cannot bulk delete customer from another company', function () {
$otherCompany = Company::factory()->create();
$otherCustomer = Customer::factory()->create([
'company_id' => $otherCompany->id,
]);
postJson('api/v1/customers/delete', [
'ids' => [$otherCustomer->id],
])->assertOk();
$this->assertDatabaseHas('customers', [
'id' => $otherCustomer->id,
]);
});